Practical Scheme To Share A Secret Key Through An Up To 27.6% Bit Error Rate 

Quantum Channel 
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A secret key shared through quantum key distribution between two cooperative players is secure 
against any eavesdropping attack allowed by the laws of physics. Yet, such a key can be established 
only when the quantum channel error rate due to eavesdropping or imperfect apparatus is low. Here, 
I report a practical quantum key distribution scheme making use of an adaptive privacy amplification 
procedure with two-way classical communication. Then, I prove that the scheme generates a secret 
key whenever the bit error rate of the quantum channel is less than 0.5 — 0.1\/5 w 27.6%, thereby 
making it the most error resistant scheme known to date. 

PACS numbers: 03.67.Dd, 89.20.Ff, 89.70.+C 



Quantum key distribution (QKD) is the process of 
sharing a secret bit string, known as the key, between two 
cooperative players, commonly called Alice and Bob, by 
exchanging quantum signals. Since an unknown quantum 
state cannot be perfectly cloned pi |) , any eavesdropping 
attempt by Eve will almost surely disturb the transmit- 
ted quantum states. Thus, by carefully estimating the 
error rate of the transmitted quantum states, Alice and 
Bob know with great confidence the quantum channel 
error rate, which in turn reflects the eavesdropping rate. 
(In contrast, Alice and Bob can never be sure if Eve has 
eavesdropped in classical key distribution because classi- 
cal signals can be copied without being caught in prin- 
ciple.) If the estimated eavesdropping rate is high, they 
abort the scheme and start over again. On the other 
hand, if the estimated eavesdropping rate is low, privacy 
amplification procedure such as quantum error correction 
or entanglement purification can be used to distill out an 
almost perfectly secure key H ^, |^| . 

It is instructive to devise a secure QKD scheme that 
tolerates as high a quantum channel error rate as possible 
and subject that scheme to a vigorous cryptanalysis. In- 
deed, Mayers || and Biham et al. B proved the security 
of the so-called BB84 QKD scheme [0 against all kinds of 
attack allowed by the laws of quantum physics. Follow- 
ing Mayers' proof, a provably secure key is established 
whenever the channel error rate is less than about 7%. 
Lo and Chau proved the security of an entanglement- 
based QKD scheme || . By scrambling the qubits before 
transmission and using the quantum Gilbert- Varshamov 
argument for a general quantum stabilizer code M, the 
Lo and Chau scheme tolerates up to about 18.9% chan- 
nel error. Nonetheless, the Lo and Chau scheme requires 
quantum computers and hence is not practical at the 
present moment. By beautifully combining the essences 
of the Mayers as well as Lo and Chau proofs, Shor and 
Preskill gave an ingenious security proof of the BB84 
scheme that applies up to 11.0% channel error ||. The 
most error resistant QKD scheme known to date was 
recently found by Gottesman and Lo. Built upon the 



Shor-Preskill proof, Gottesman and Lo showed that a 
carefully designed privacy amplification procedure with 
two-way communication increases the error tolerant level 
of a QKD scheme. In particular, they proved that the six- 
state QKD scheme introduced by Brufi |l(| tolerates up 
to about 23.7% bit error rate (or equivalently up to about 
35.5% channel error rate) [jllj. Recently, Gottesman and 
Lo further improved their two-way communication pro- 
tocol and showed that it generates a provably secure key 
up to 26.4% bit error rate (Here, the channel error 
rate and bit error rate refer to the rate of quantum and 
spin flip errors occurring in the insecure noisy quantum 
channel respectively.) 

Here, I report an adaptive privacy amplification proce- 
dure for the six-state scheme. Then, I prove that this pro- 
cedure enables the six-state scheme to generate a prov- 
ably secure key up to 0.5 — 0.1V5 w 27.6% bit error rate 
(or equivalently up to 0.75 — 0.15\/5 « 41.4% quantum 
channel error), breaking the 26.4% bit error rate record of 
Gottesman and Lo. This scheme is also practical, requir- 
ing no quantum computer or search for asymptotically 
good quantum codes. Since no BB84-based scheme can 
tolerate more than 25% bit error rate Q, the 27.6% bit 
error rate tolerable six-state scheme reported here con- 
vincingly demonstrates the advantage in error tolerability 
of the six-state scheme over BB84. 

Before reporting the adaptive procedure, let me briefly 
review the privacy amplification procedure introduced 
by Gottesman and Lo jll). In the first step of the 
Gottesman-Lo privacy amplification procedure, Alice 
and Bob perform entanglement purification with local 
quantum operation and two-way classical communication 
(LOCC2 EP). Specifically, they randomly pair up their 
corresponding bits in the string and compare the result of 
a bilateral exclusive or (BXOR) in each pair. They keep 
their corresponding control bits in each pair only if their 
parities agree. In the second step, Alice and Bob apply 
the [3, 1,3]2 phase error correction (PEC). This is equiv- 
alent to randomly forming trios of the remaining bits and 
replace each trio by their corresponding parities [O . Al- 
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ice and Bob apply LOCC2 EP and PEC alternatively 
until the error rate of the resultant signal can be handled 
by an asymmetric Calderbank-Shor-Steane (CSS) quan- 
tum code [jl3|, [l4| with great confidence. Then, they ap- 
ply the Shor-Preskill error correction procedure |^] to the 
remaining bits using the above CSS code. By doing so, 
they end up sharing a secret key with exponentially close 
to 100% confidence. Gottesman and Lo further showed 
that their procedure brings down the error rate whenever 
the channel error rate is less than about 23.7% 

The Gottesman-Lo two-way privacy amplification pro- 
cedure reviewed above can be improved in two ways. 
First, there is no reason why one must apply LOCC2 
EP and PEC alternately. Instead, Alice and Bob should 
devise a suitable privacy amplification procedure based 
on the estimated a x , o~ y and a z error rates of the qubits 
transmitted through the insecure noisy channel. Besides, 
they may use [r, I , r] 2 for some r > 3 as their phase error 
correction code. In fact, using this approach, Gottes- 
man and Lo proved that the six-state scheme can toler- 
ant a bit error rate up to 26.4% |l2). Second, although 
the asymmetric CSS code used by Gottesman and Lo 
is known to exist using Gilbert- Varshamov type of argu- 
ment |p| , explicitly finding it may be difficult in general. 
Fortunately, concatenated quantum CSS code is already 
sufficient in handling the final error correction in the pri- 
vacy amplification procedure. More importantly, various 
concatenated quantum CSS codes and their decoding al- 
gorithms are known. 

Before I report my six-state scheme, I first call upon 
two propositions below to study the effects of LOCC2 EP 
and PEC on the error rates of the signal. 

Proposition 1. Suppose Alice sends Bob several qubits 
through a quantum channel whose a x , o~ y and a z error 
rates due to either noise or eavesdropping are p x , p y and 
p z respectively. Let pj = 1 — p x — p y — p z . If the error 
suffered by each qubit is independent of the other, then 
the error rates of the resultant qubits after going through 
one around of LOCC2 EP are given by 
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and apply BXOR to each pair. During the BXOR opera- 
tion, any o~ x error in the control qubit remains unaltered. 
In contrast, the a z error of the resultant control qubit is 
inherited from both the original control and target qubits 
]l5[ . Since Alice and Bob reject the pair if the measure- 
ment results of their share of target qubit differ, hence 
the remaining control qubit is error-free if the error op- 
erator acting on the original control and target qubits 
equals / <g> / or a z C3> a z . Similarly, the remaining control 
qubit suffers a x , o~ y , and o~ z errors if the error operator 
acting on the original control and target qubits equals 
o~ x ® &x or o y ® o~ y , o~ x ® <jy or o~ y <8> o~ x , and I ® u z or 
o~ z ® I respectively. Since error suffered by each qubit 
is independent of each other, hence Eq. (Q) holds. The 
independence of resultant error rates after the LOCC2 
EP procedure follows directly from the independence of 
channel error for the qubits received by Bob. □ 

By Proposition [l] and mathematical induction, it is 
straight-forward to check that the error rates of the re- 
sultant qubits after going through k rounds of LOCC2 
EP are given by 
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where D = (pi + p x ) 2 " + (p x + p y ) 2 
> 1/2, pf EP > 1/2 and p k z EP 
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is, repeated application of LOCC2 EP reduces a x and 
Oy errors at the expense of possibly increasing o~ z and 
perhaps also the overall error rates. 

Proposition 2. We use the notations in Proposition 
Suppose Alice and Bob divide their shared pairs into n 
sets each containing r shared pairs. And then they per- 
form one round of PEC using the [r,l,r]z majority vote 
phase error correction code. The resultant error rates of 
the signal after one round of PEC satisfy 
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provided thatpi > 1/2. Also, the error rate in each of the 
resultant qubit after PEC is independent of each other. 

Proof. The idea of the proof is the same as that in Propo- 
sition 0. Recall that the error syndrome of the [r, 1, r]2 
phase error correction code is given by 



Furthermore, the error rate in each of the resultant qubit 
after the LOCC2 EP is independent of each other. 

Proof. Recall that in the LOCC2 EP, Alice and Bob ran- 
domly pair up their corresponding shares of the qubits 
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So, after measuring this error syndrome, the a z error 
stays on the control qubit while the a x error propagates 
from the control as well as all target qubits to the resul- 
tant control qubit [p|. Therefore upon PEC, the resul- 
tant control qubit is spin-flip error-free whenever there 
is an even number of qubits amongst the r of them in 
the same set suffering spin-flip error. Hence, the first 
inequality in Eq. (^) holds. Similarly, the resultant con- 
trol qubit suffers from phase-shift error provided that at 
least ["(? — l)/2] out of the r qubits are suffering from 
phase-shift error. Such a probability of occurrence equals 

Eo>f( r -i)/21 0(Py+Pz) a (Pi+Px) r ~ a - Combining with 
the inequality 

An , s 

( \ P k {i-p) n - k < \- xn {i-\)- {i -^ n p xn {i- P ) {i - x ^ 

(5) 

for < A < p, we conclude that the probability of having 
a phase error is upper bounded by [^{pi+p x ){p y +p z )Y^ 2 ■ 
Thus, the first line of the second inequality in Eq. (Q) is 
satisfied. To arrive at the second line, one simply con- 
siders the Taylor series expansion of log[l + (2p/ + 2p x — 
1 ) ] + log [ 1 + ( 2p y + 2p z — 1 ) ] and uses the observation that 
all odd power terms in the expansion are canceled. □ 

Proposition || tells us that if 0.5—p z —p y 3> y/p x + p y , 
the phase error can be greatly reduced after one round 
of PEC by choosing r w 0.01/(p x + py)- Specifically, 
with this choice of r, Eq. (|) implies that p y EC +p^ EC is 
exponentially small while p^. EC + P y EC is at most about 
1%. 

Alice and Bob may exploit the dynamics of LOCC2 
EP and PEC to perform their privacy amplification. 
Specifically, they first repeatedly apply LOCC2 EP until 
0.5 ~ p z — Py 3> \JPx + Py ■ Then, applying PEC once 
will bring the overall error rate p x + p y + p z down to an 
acceptable value. And then, Alice and Bob may choose 
to use the concatenated Steane's seven qubit code in the 
Shor-Preskill procedure. Recall that Steane's seven qubit 
code corrects one error out of seven qubits |jl4| . Thus, as 
long as Alice and Bob randomly permute the bits before 
applying the Shor-Preskill procedure, the overall error 
rate that is almost surely tolerated by the concatenated 
Steane's seven qubit code is equal to the smallest positive 
root of the equation 

1 - A= (1 - A) 7 + 7(1 - A) 6 A, (6) 

namely, about 5.8%. The upshot is that the error correc- 
tion algorithm for the concatenated Steane's seven qubit 
code is known and can be carried out efficiently. 

With these two improvements in mind, I write down 
my modified six-state scheme below. 

1 . Alice prepares N qubits each randomly chosen from 
|0), |1), |0) ± |1) and |0) ± and sends them to 



Bob [^0|. Bob acknowledges the reception of the 
qubits and measures each of them randomly and in- 
dependently along one of the following three bases: 
{|0>, {|0) ± |1)} and {|0) ± Then, Al- 

ice and Bob publicly announce the bases they have 
used to prepare or measure each qubit. They keep 
only those qubits that are prepared and measured 
in the same basis. 

2. Alice and Bob estimate the channel error rate by 
sacrificing a few qubits. Specifically, they divide 
the qubits into three sets according to their bases 
of measurement. They randomly pick 0(log[l/e]) 
qubits from each set and publicly compare the 
preparation and measurement results of each cho- 
sen qubit. In this way, they know the estimated 
channel error rate with standard deviation e. (De- 
tail proof of this claim can be found in Ref. If 
the estimated channel error rate is too high, they 
abort the scheme and start over again. 

3. Using the convention that |0), |0) — |1) and |0) — 

represent a logical while the |I), |0) + |1) 
and |0) represent a logical 1, Alice and Bob 

convert their untested measured qubits into secret 
strings. Then, they perform the following privacy 
amplification procedure on their secret bit strings. 

(a) They apply the LOCC2 EP procedure pro- 
posed by Gottesman and Lo in Ref. [pd| . 
Specifically, they randomly pair up their cor- 
responding secret bits and announce the pari- 
ties of each pair. They keep the control bit in 
each pair only if their announced parities for 
the pair agree. They repeat the above LOCC2 
EP procedure until there is an integer r > 
such that the estimated quantum channel er- 
ror given by Eq. (||) is less than 5%. They 
abort the scheme either when such an integer 
r is greater than the number of remaining bits 
they have or when they have used up all their 
bits in this procedure. 

(b) They apply the PEC procedure introduced 
by Gottesman and Lo in Ref. Jll[ using the 
[r, l,r]a majority vote phase error correction 
code once. Specifically, Alice and Bob ran- 
domly divide the resultant bits into sets each 
containing r bits. They replace each set by 
the parity of the r bits in the set. 

(c) Alice and Bob randomly permute the order 
of their remaining bits and apply the Shor- 
Preskill privacy amplification procedure j 7 ^ 
to these bits with the concatenated Steane's 
seven qubit code. The level of concatenation 
depends on the estimated worst case p x +p y + 
p z given by Eq. (^|) and the final required fi- 
delity of the state. Specifically, suppose that 
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the concatenated Steane's seven qubit code is 
constructed from two binary classical codes C\ 
and C 2 satisfying C 2 C C±. Alice randomly 
picks a codeword u € C\ and publicly an- 
nounces the sum of u and her remaining bit 
string modulo 2. Bob subtracts Alice's an- 
nounced bit string from his own remaining bit 
string modulo 2; and then he applies the Ci er- 
ror correction to recover the codeword u € C\ . 
They use the coset u + C2 as their secret key. 



To prove the security of the above scheme, I follow 

s s 



the arguments of Refs. || |9[ fLy, |17| . First, since this is 
a prepare-and-then-measure scheme, any Eve's quantum 
cheating strategy can be reduced to a classical one ||, |l7) . 
Second, Eve does not know how Alice and Bob group the 
qubit pairs in LOCC2 EP and PEC beforehand. Hence, 
the resultant error rate after going through either LOCC2 
EP or PEC depends only on the probabilities of a x , 
<jy and a z errors and the number of qubits transmitted 
H 0. Thus, to study the asymptotic error tolerable 
rate of the above scheme, it suffices to consider cheating 
strategies characterized only by p x , p y and p z respec- 
tively. Since Alice chooses the six states randomly and 
uniformly, the untested qubits can be regarded as having 
passed through a depolarizing channel O], Hence, Alice 
and Bob almost surely know that p x = p y = p z for their 
untested qubits. 

From Eq. (||) in Proposition ||, I know that after ap- 
plying LOCC2 EP k times, PEC will bring the quantum 
error rate down to, say, 5% if r = 0.04/(pJ; EP + p y EP ) 



and 2r(0.5 - p* tp - p^ F ) > 1. Putting p x = p y = 
p z = (1 — pi)/i into Eq. (||), I conclude that this is pos- 
sible when k — > 00 and (pi — p z ) 2 > (pi + p z ){Px +Py)- 
This condition implies that 20pj — 10pi — 1 > or 
pi > 0.25+0.15-^/5- In other words, the above scheme tol- 
erates a bit error rate up to p x +p y = 0.5— 0.1\/5 ~ 27.6% 
(which corresponds to a quantum channel error rate of 
p x +p y +p z = 0.75- 0.15\/5« 41.4%). 

Besides, once Alice and Bob estimate the channel er- 
ror rates, then they can efficiently compute the num- 
ber of LOCC2 EP to be applied as well as the level of 
concatenation for the Steane's seven qubit code to be 
used. Finally, the error syndrome of the concatenated 
Steane's seven qubit code as well as the corresponding 
Shor-Preskill procedure are straight-forward to compute. 

The 27.6% bit error rate bound reported here shows 
that the six-state scheme is more noise resistant than the 
BB84 scheme since no BB84 scheme can tolerate more 
than 25% bit error fl2]| . In addition, the adaptive pri- 
vacy amplification idea can be applied to increase the 
error tolerant level in a number of QKD schemes. For 
instance, the above adaptive privacy amplification pro- 



cedure enables the BB84 to generate a provably secure 
key whenever the bit error rate is less than 20.0% (or 
equivalently, a quantum channel error rate of less than 
39.9%). Besides, one can show the existence of a bi- 
ased entanglement-based QKD scheme requiring quan- 
tum computers whose key is provably secure whenever 
the bit error rate is less than 33.3% |ll|. 
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